From: George Ogata Date: 2016-11-23T19:52:23-05:00 Subject: [ruby-core:78288] Deserialization & const_missing --===============0230235751== Content-Type: multipart/alternative; boundary=94eb2c1923085d3bab0542016c42 --94eb2c1923085d3bab0542016c42 Content-Type: text/plain; charset=UTF-8 Hi, I'm finding an issue with deserializing (Marshal, YAML) objects whose classes are lazily loaded. Here's a demo: (run with argument 'store' and then with argument 'load') module C def self.const_missing(name) const_set name, Struct.new(:x, :y) end end case ARGV[0] when 'store' lazy = C::Lazy.new(1, 2) open('test.marshal', 'w') { |f| Marshal.dump(lazy, f) } when 'load' lazy = open('test.marshal') { |f| Marshal.load(f) } p lazy else abort "need argument: load or store" end I saw this was discussed a few months ago in the Developers' Meeting. Here are the notes: * [Feature #3511] rb_path_to_class should call custom const_defined? methods (shyouhei) * akr: this is dangerous to implement. * ko1: is this backward compatible? akr: it seems. * Matz: It seems it hurts than it gains. Could someone please summarize the dangers here? What I would love is the ability to opt-in to allowing this behavior. I understand there could be some danger if you autoload in multiple threads at once, but in my use case (a rails app that serializes objects to a job queue and processes them on other machines), we do not have this danger because the processes involved are single-threaded. Would you consider having an option that lets us turn on such behavior? References: * https://bugs.ruby-lang.org/issues/3511 * https://bugs.ruby-lang.org/issues/12731 Thanks! --94eb2c1923085d3bab0542016c42 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Hi,


I'm finding an issue with deser= ializing (Marshal, YAML) objects whose classes are lazily loaded.


Here's a demo: (run with argume= nt 'store' and then with argument 'load')


module C

=C2=A0 def self.const_missing(name)=

=C2=A0 =C2=A0 const_set name, Struc= t.new(:x, :y)

=C2=A0 end

end


case ARGV[0]

when 'store'

=C2=A0 lazy =3D C::Lazy.new(1, 2)

=C2=A0 open('test.marshal',= 'w') { |f| Marshal.dump(lazy, f) }

when 'load'

=C2=A0 lazy =3D open('test.mars= hal') { |f| Marshal.load(f) }

=C2=A0 p lazy

else

=C2=A0 abort "need argument: l= oad or store"

end



I saw this was discussed a few mont= hs ago in the Developers' Meeting. Here are the notes:


=C2=A0 * [Feature #3511] rb_path_to= _class should call custom const_defined? methods (shyouhei)

=C2=A0 =C2=A0 * akr: this is danger= ous to implement.

=C2=A0 =C2=A0 * ko1: is this backwa= rd compatible? akr: it seems.

=C2=A0 =C2=A0 * Matz: It seems it h= urts than it gains.


Could someone please summarize the = dangers here?


What I would love is the ability to= opt-in to allowing this behavior. I understand there could be some danger = if you autoload in multiple threads at once, but in my use case (a rails ap= p that serializes objects to a job queue and processes them on other machin= es), we do not have this danger because the processes involved are single-t= hreaded.


Would you consider having an option= that lets us turn on such behavior?


References:

=C2=A0* https://bugs.ruby-lang.org/i= ssues/3511

=C2=A0* https://bugs= .ruby-lang.org/issues/12731


Thanks!


--94eb2c1923085d3bab0542016c42-- --===============0230235751== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Unsubscribe: --===============0230235751==--